Choosing a VPN

VPNs (Virtual Private Networks) have become increasingly popular over time, and while you may have already heard of these services, you might be unsure about which VPN provider to choose or whether to use a VPN at all. As with many things related to technology and security the answers aren't always straightforward and it's hard to come by reliable information.

In my attempt to research this area myself, I've found a lot of contradicting information. Various tech sites out there list what they consider the top 5 (or 10 or some other number) VPNs and the more I looked around it seemed there's no clear consensus as to which are the best VPNs. Further research (particularly on YouTube) has revealed several hardcore privacy advocates that seem to strongly argue against the use of VPNs. It seemed the more research I did the more confused I ended up being. Should you get a VPN or not? If you do, how can you decide which of the many (and there do seem to be many) providers to choose from?

In this blog post I'll walk through some of the benefits of VPNs and what to keep in mind. I'll try to keep the information as objective as possible while presenting different points of view that should hopefully help someone interested find out whether choosing a VPN is right for them and how to go about choosing one.

What is a VPN?

A VPN, or virtual private network, allows users to send data, while connected to a public or less-secure network, as if they were on a private network. There are different kinds of VPNs and uses for a VPN. One popular use is for businesses: employees can securely connect to the corporate network while working remotely, even from far less secure locations such as a coffee shop. Used this way, employees will connect to the corporate network and can access resources as if they were working from the office. Another use is for individuals to hide their internet traffic from ISPs or the current local network (especially if it is less secure) as well as to avoid geo-restrictions.

For more details, please see the post on VPNs at Wikipedia. I would also strongly recommend reading documentation at EFF on choosing the VPN right for you as well as limitations of VPNs. The last two links provide some really well-written and objective information to help you better understand VPNs.

Benefits of a VPN

As mentioned in the preceding section, a VPN makes a lot of sense for a corporation as it allows employees to connect to the corp network securely and to continue working remotely. The security benefits of a VPN make it possible to connect even from less secure locations, such as a coffee shop or airport, since the traffic is encrypted and cannot be viewed by anyone else on that same (insecure) network. Of course, the traffic is only encrypted up until it arrives at the company, at which point it is decrypted and potentially visible for monitoring, logging, and general inspection by employees at the company. In practice, however, that's not necessarily any less security that if the employee were directly at the office: companies are likely to perform logging of user activity and you are effectively placing a certain amount of trust in the company you work for with regards to how much they respect the privacy of what you do on their network.

For the average internet user, a VPN can provide a number of useful features:

1. Hiding internet activity from ISPs.
2. Securing traffic on local (unsecure) networks.
3. Geo-restriction circumvention.

Hiding internet activity from ISPs

An internet user may have cause to prevent their ISP from inspecting their internet traffic. There could be several legitimate reasons for doing so: (a) there may be privacy concerns that the ISP may log the traffic and make it available to the government; (b) the ISP may choose to throttle traffic based on the sites being visited or even choose to block traffic to certain sites.

Securing traffic on local (unsecure) network

If you're using the (typically insecure) network of a coffee shop, airport, or any other place with a network you don't trust, making use of a VPN can be very useful. A VPN will encrypt your internet traffic so that folks on the same network cannot snoop what you're doing on the network or get any value from logging your traffic.

Geo-restriction circumvention

Since VPNs host servers in many different countries, it is possible to make it appear to the destination site as if your request is originating from a different country/region to where you currently are. This can be useful to bypass restrictions imposed by a government or to get around restrictions content providers may have: this is actually a very popular use of VPNs, since users may wish to still access video streaming content only available in another country.

Even if you as a user are not interested in circumventing government restrictions or plan to access content restricted to other countries, you may still wish to choose servers in other regions. A few such reasons:

1. You may wish to spoof your location as coming from another country, just for the purpose of avoiding appearing from your present location.
2. Another reason would be to take advantage of appropriate defaults afforded to a site in a different country. For example, you might be visiting a different country but would still like to see your favorite site in your preferred language. Most sites have an option to change the language, but it's pretty annoying to have to do so every time you visit. Using a VPN you can spoof your location to be your home location and have the web site appear as if you issued the query from that country.
3. You may also wish to take advantage of the fact that the sales price of different items varies based on country. The price shown at different travel sites can differ widely depending on the region you issue the search from, for example.

Possible Drawbacks

So far, VPNs sound great. But it is important to note that they don't offer perfect security or privacy. Here are a few issues that should be kept in mind when evaluating and using a VPN:

1. VPNs may log your internet traffic.
2. VPN companies may be compromised by cybercriminals.
3. VPNs don't make you fully anonymous.

VPNs may log your internet traffic

While pretty much every VPN out there will promise not to log your traffic, there have been cases in the past where government agencies requested logs from VPN providers and were able to receive the requested logs. If the "no log" policy was truly preserved then surely there'd have been no way to give any logs over. So clearly some (if not all) VPN providers are lying when they claim they don't keep any logs. Personally, it seems hard for me to believe they don't keep any logs at all. I'd imagine they'd need some sort of logging to help improve their service and understand how the service is being used. At the very least they'd need to keep enough information to help debug issues that arise.

My advice here is to do thorough research when choosing your VPN provider. Read the fine-print carefully regarding their privacy and logging policy. Read up on what others think about the VPN and be especially careful to see if there have been any incidents in the past where government agencies requested data. Even after choosing a VPN you consider trustworthy it's probably best to assume they log your traffic. That might seem counterintuitive but at the least this will avoid surprises. Perhaps the better approach is to figure out what they log and ensure it's not more than what you're comfortable with.

VPN companies may be compromised by cybercriminals

Even if a VPN company refuses to give up logs when requested, there is always the possibility that the company itself is compromised by cybercriminals. The outcome here could be pretty bad. Sure the criminals could get access to your logs (if any exist), but they could also keep tabs on your traffic and set themselves up as a man-in-the-middle until such time as the VPN provider wises up to the intrusion.

VPNs don't make you fully anonymous

One of the misconceptions about the use of VPN is that they makes you anonymous. Perhaps part of the reason for this is the fact that VPNs can be used to mask your IP address. However, this alone is not enough to make you anonymous. Ad trackers on sites you visit can still give you away, and your operating system, browser, computer, and other information can all be combined to form some sort of digital fingerprint that can still be used to identify you. Your activity on social media sites could also contribute towards indicating who you are.

A VPN can certainly be used in conjunction with other tools and good browsing habits to improve your anonymity and security, but by itself is not enough.

Conclusion

There is a lot of hype promoting VPNs as an amazing technology to help you stay private and secure, and there's also a lot of negativity surrounding VPNs. Ignore the hype coming from both sides here and stay objective when evaluating whether or not a VPN is right for you. In my opinion a trusted VPN can be quite useful as part of an overall security strategy. By itself it's likely not enough though, but if you choose a trustworthy provider and use the VPN appropriately given your situation and security requirements then this can be very beneficial. Stay safe!